CVE-2025-27113

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.(CVE-2024-56171)

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.(CVE-2025-24928)

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.(CVE-2025-27113)

Root has patched CVE-2025-27113 in the libxml2 package for Root:Alpine:3.15. Multiple fixed versions available.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

• CVE-2025-27113: fix NULL pointer dereference in xmlPatMatch in pattern.c

• CVE-2025-27113: fix compilation of explicit child axis

• SECURITY UPDATE: buffer over-read in xmlHTMLPrintFileContext
  • debian/patches/CVE-2024-34459.patch: Fix buffer overread with xmllint --htmlout by adding a missing bounds check
  • CVE-2024-34459
• SECURITY UPDATE: use-after-free vulnerability in xinclude.c
  • debian/patches/CVE-2022-49043.patch: Fix use-after-free in xmlXIncludeAddNode, free URI after reporting the error to avoid use-after-free
  • CVE-2022-49043
• SECURITY UPDATE: stack-based buffer overflow in xmlSnprintfElements in valid.c
  • debian/patches/CVE-2025-24928.patch: Fix stack-buffer-overflow in xmlSnprintfElements caused by improperly calculating qname length
  • CVE-2025-24928
• SECURITY UPDATE: NULL pointer dereference in xmlPatMatch in pattern.c
  • debian/patches/CVE-2025-27113.patch: Fix compilation of explicit child axis to generate XML_OP_ELEM like the case without an axis
  • CVE-2025-27113
• SECURITY UPDATE: use-after-free vulnerability in XML schema processing
  • debian/patches/CVE-2024-56171.patch: Fix use-after-free after xmlSchemaItemListAdd in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables
  • CVE-2024-56171

• SECURITY UPDATE: buffer over-read in xmlHTMLPrintFileContext
  • debian/patches/CVE-2024-34459.patch: Fix buffer overread with xmllint --htmlout by adding a missing bounds check
  • CVE-2024-34459
• SECURITY UPDATE: use-after-free vulnerability in xinclude.c
  • debian/patches/CVE-2022-49043.patch: Fix use-after-free in xmlXIncludeAddNode, free URI after reporting the error to avoid use-after-free
  • CVE-2022-49043
• SECURITY UPDATE: stack-based buffer overflow in xmlSnprintfElements in valid.c
  • debian/patches/CVE-2025-24928.patch: Fix stack-buffer-overflow in xmlSnprintfElements caused by improperly calculating qname length
  • CVE-2025-24928
• SECURITY UPDATE: NULL pointer dereference in xmlPatMatch in pattern.c
  • debian/patches/CVE-2025-27113.patch: Fix compilation of explicit child axis to generate XML_OP_ELEM like the case without an axis
  • CVE-2025-27113
• SECURITY UPDATE: use-after-free vulnerability in XML schema processing
  • debian/patches/CVE-2024-56171.patch: Fix use-after-free after xmlSchemaItemListAdd in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables
  • CVE-2024-56171

• CVE-2025-27113: fix compilation of explicit child axis

• CVE-2025-27113: fix compilation of explicit child axis

• CVE-2025-27113: fix compilation of explicit child axis

• CVE-2025-27113: fix compilation of explicit child axis

• CVE-2025-27113: fix compilation of explicit child axis

• CVE-2025-27113: fix compilation of explicit child axis

• CVE-2025-27113: fix NULL pointer dereference in xmlPatMatch in pattern.c

The updated packages fix security vulnerabilities: Use-after-free in xmlSchemaIDCFillNodeTables. (CVE-2024-56171) Stack-buffer-overflow in xmlSnprintfElements. (CVE-2025-24928) Null-deref in xmlPatMatch. (CVE-2025-27113)

These are all security issues fixed in the libxml2-2-2.13.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libxml2 fixes the following issues:

• CVE-2024-56171: use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c (bsc#1237363).
• CVE-2025-24928: stack-based buffer overflow in xmlSnprintfElements in valid.c (bsc#1237370).
• CVE-2025-27113: NULL pointer dereference in xmlPatMatch in pattern.c (bsc#1237418).

This update for libxml2 fixes the following issues:

• CVE-2024-56171: use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c (bsc#1237363).
• CVE-2025-24928: stack-based buffer overflow in xmlSnprintfElements in valid.c (bsc#1237370).
• CVE-2025-27113: NULL pointer dereference in xmlPatMatch in pattern.c (bsc#1237418).

This update for libxml2 fixes the following issues:

• CVE-2024-56171: use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c (bsc#1237363).
• CVE-2025-24928: stack-based buffer overflow in xmlSnprintfElements in valid.c (bsc#1237370).
• CVE-2025-27113: NULL pointer dereference in xmlPatMatch in pattern.c (bsc#1237418).

This update for libxml2 fixes the following issues:

• CVE-2024-56171: Fixed use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c (bsc#1237363).
• CVE-2025-24928: Fixed stack-based buffer overflow in xmlSnprintfElements in valid.c (bsc#1237370).
• CVE-2025-27113: Fixed NULL Pointer Dereference in libxml2 xmlPatMatch (bsc#1237418).

This update for libxml2 fixes the following issues:

• CVE-2024-56171: Fixed use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c (bsc#1237363).
• CVE-2025-24928: Fixed stack-based buffer overflow in xmlSnprintfElements in valid.c (bsc#1237370).
• CVE-2025-27113: Fixed NULL Pointer Dereference in xmlPatMatch (bsc#1237418).

This update for libxml2 fixes the following issues:

• CVE-2024-56171: Fixed use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c [bsc#1237363]
• CVE-2025-24928: Fixed stack-based buffer overflow in xmlSnprintfElements in valid.c [bsc#1237370]
• CVE-2025-27113: Fixed NULL Pointer Dereference in libxml2 xmlPatMatch [bsc#1237418]

It was discovered that libxml2 incorrectly handled certain memory operations. A remote attacker could use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2022-49043)

It was discovered that the libxml2 xmllint tool incorrectly handled certain memory operations. If a user or automated system were tricked into running xmllint on a specially crafted xml file, a remote attacker could cause xmllint to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-34459)

It was discovered that libxml2 did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-56171)

It was discovered that libxml2 could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-24928)

It was discovered that libxml2 could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-27113)